To begin with, the plot is shown below for all movements throughout the 2 weeks of dataset.
From here, the discussion will be divided into confirmation of anomalies found in Q1 and anomalies found in this dataset itself.
To recap, listed below are the anomalies found in the transaction data.
The museum goers that go in group then a solo traveler one hour later every week.
Very high spending on “Frydo’s Autosupply and More”
High spending in “Albert’s Fine Clothing”
The investigation begins by looking at the museum.
Simple feature collection with 6206 features and 5 fields
Geometry type: POINT
Dimension: XY
Bounding box: xmin: 24.82587 ymin: 36.04802 xmax: 24.90835 ymax: 36.08975
Geodetic CRS: WGS 84
First 10 features:
Timestamp id geometry Name
1 2014-01-06 07:20:01 1 POINT (24.88258 36.06646) Nils Calixto
2 2014-01-06 07:22:04 1 POINT (24.88587 36.06366) Nils Calixto
3 2014-01-06 07:57:01 1 POINT (24.88593 36.06371) Nils Calixto
4 2014-01-06 08:04:09 1 POINT (24.87957 36.04803) Nils Calixto
5 2014-01-06 12:17:01 1 POINT (24.87957 36.04802) Nils Calixto
6 2014-01-06 12:26:27 1 POINT (24.85759 36.07666) Nils Calixto
7 2014-01-06 13:25:01 1 POINT (24.85757 36.07668) Nils Calixto
8 2014-01-06 13:34:27 1 POINT (24.87957 36.04803) Nils Calixto
9 2014-01-06 17:44:01 1 POINT (24.87957 36.04803) Nils Calixto
10 2014-01-06 17:48:03 1 POINT (24.8826 36.06649) Nils Calixto
Position Department
1 IT Helpdesk Information Technology
2 IT Helpdesk Information Technology
3 IT Helpdesk Information Technology
4 IT Helpdesk Information Technology
5 IT Helpdesk Information Technology
6 IT Helpdesk Information Technology
7 IT Helpdesk Information Technology
8 IT Helpdesk Information Technology
9 IT Helpdesk Information Technology
10 IT Helpdesk Information Technologypositions show no significant activities, all visitors are different people. It is to note that 3 of work in the same department (security). However, there is no confidence that this is suspicious. Also to note is the missing gps data for January 19th where there are supposed to be 2 people in the museum, this is marked up as error in data.
Take a look at when the big transaction was made.
X location price mdy
595 595 Frydos Autosupply n' More 10000 2014-01-13
timestamp last4ccnum H loyaltynum
595 2014-01-13 19:20:00 9551 19 <NA>By knowing that this transaction happens in 19:20, the gps data can be filtered by the hour. For this case between 18:30 and 19:20 considering the time needed for arrival, negotiation and payment processing.
The graph shows that Minke Mies is the suspect of this transaction, They are shown to arrive at 18:00 and leave by 19:29. Looking at their credentials, something may be wrong.
Name CurrentEmploymentType CurrentEmploymentTitle
24 Minke Mies Security Perimeter ControlImportant to note that Minke works as a perimeter control.Also equally important is the fact that their job title has a pay grade logically possible for such a purchase nor the job description which tasks them with purchasing such an item for work. It is recommended that Minke is subjected to additional investigation.
Overall, there wasn’t much suspicious movements happening with Minke. However, they were caught at parks at 3 am. More specifically at “Spetson Park” and “Taxiachen Park”. This calls for a further investigation, more specifically in night times which will be discussed in the next section.
Same as before, the time of transaction is taken first.
X location price mdy timestamp
159 159 Albert's Fine Clothing 1239.41 2014-01-17 2014-01-17 19:44:00
last4ccnum H loyaltynum
159 1321 19 L4149Axel Calzas is the only employee in location, and as such would be the buyer of the 1000 transaction. Timeline also fits as he arrives in 18:25 and leaves at 19:46, 2 minutes after the payment. Working as a Hydraulic Technician, there is no tell that this is a suspicious activity.
For this sub-section, the dataset is first filtered based on the priority of worker department. If it is to be assumed that Protector of Kronos is behind the dissapearances, then it can also be assumed that the main target would be Executive personnels for being responsible in company activities.
This first plot shows the movements of the Executive personnels.
The graph shows that all executive personnel lives in the northeast housing block near “Ahaggo Museum” except for CEO Stan Sanjorge Jr. which does not have a permanent housing in Abila and instead stays in Chostus Hotel. It is also worth mentioning that the area is between “Spetson Park” and “Taxiachen Park”, 2 locations with anomalies where security employee Minke Mies has been confirmed visiting at 3 AM.
To better identify suspicious movements in the area, the timeframe is set between 11 PM and 5 AM. This is done considering that parks and museums are in the vicinity, therefore employees that come to the area during “normal” times can be assumed to be visiting those places while people coming at the set timeframe would have a harder time explaining their purpose.
Several names pop up in the vicinity with different time. Listed below:
Name CurrentEmploymentType CurrentEmploymentTitle
15 Loreto Bodrogi Security Site Control
16 Isia Vann Security Perimeter Control
21 Hennie Osvaldo Security Perimeter Control
24 Minke Mies Security Perimeter Control
28 Isande Borrasca Engineering Drill TechnicianDepending on the job description of perimeter control and site control, all 4 security employees may have a clear purpose on why they were there. However, the same cannot be said for Engineering staff Isande Borrasca. Further analysis should be made regarding this employee.
Employee movement shows 3 clusters of location within the Executive housing block either early in the morning before work or after office hours. It is important authorities question more regarding the motive of these movements as well as check any relation employee has with the case.
To make it easier to see the movements, the map is divided based on the employees’ departments.
The biggest anomaly would be a gathering happening at January 10th late at night in the north housing block. All engineering employees were there except for Isande Borrasca which gps shows no log of her movement on that day.
The IT department was also present in the late night gathering with the Engineering department, save for one person as well which was Sven Flecha. No gps data can be pulled to infer where he was during that time.
Outside of the anomalies discussed during the ‘Proximity’ section, no other anomalies were found.
Something to note would be Bertrand Ovan’s trips to “Roberts and Sons” which could be a legal firm indicating a possible issue. But otherwise no suspicious movements have been found.
Willem Vasco-Pais was shown to be in the Kronos Capitol on January 11th from 14:01 until 17:24. No unusual movements are found otherwise.